Skip to content
OpenAdvisories
Critical ICSA-25-044-16 4 CVEs

mySCADA myPRO Manager

Published Feb 13, 2025 · Updated Feb 13, 2025

Vendor: mySCADA Product: myPRO Manager

Summary

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary OS commands, upload files, and obtain sensitive information without providing associated credentials.

Vulnerabilities 4

  • Critical 10.0
    CVE-2025-24865 Public exploit

    mySCADA myPRO Manager Missing Authentication for Critical Function

    The administrative web interface of mySCADA myPRO Manager can be accessed without authentication which could allow an unauthorized attacker to retrieve sensitive information and upload files without the associated password.

    mySCADA myPRO Manager
  • Critical 9.8
    CVE-2025-25067

    mySCADA myPRO Manager OS Command Injection

    mySCADA myPRO Manager is vulnerable to an OS command injection which could allow a remote attacker to execute arbitrary OS commands.

    mySCADA myPRO Manager
  • High 8.6
    CVE-2025-22896 Public exploit

    mySCADA myPRO Manager Cleartext Storage of Sensitive Information

    mySCADA myPRO Manager stores credentials in cleartext, which could allow an attacker to obtain sensitive information.

    mySCADA myPRO Manager
  • Medium 6.3
    CVE-2025-23411

    mySCADA myPRO Manager Cross-Site Request Forgery

    mySCADA myPRO Manager is vulnerable to cross-site request forgery (CSRF), which could allow an attacker to obtain sensitive information. An attacker would need to trick the victim in to visiting an attacker-controlled website.

    mySCADA myPRO Manager

Revision history

  1. #1

    Initial Publication

References